Results 1 to 2 of 2

Thread: Infected by wintems.exe & hldrrr.exe

  1. 2008-03-31, 13:49 #1
    sotong
    sotong is offline
    Junior Member
    Join Date
    Aug 2006
    Posts
    10

    Default Infected by wintems.exe & hldrrr.exe

    Hi, my PC has been infected by above virus/malware.

    Used ComboFix utility & deleted these nasty files.

    However, I find that my AVG antivirus software is still not working so I'll reinstall it.

    I need to know if my PC is clean and safe. Please review. Thank you.

    ComboFix 08-03-30.3 - Anthony 2008-03-31 21:56:59.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.674 [GMT 11:00]
    Running from: J:\Files to remove wintems virus\Combo-Fix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    TimedOut: progfile.dat

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Anthony\Application Data\inst.exe
    C:\WINDOWS\system32\drivers\down
    C:\WINDOWS\system32\drivers\down\1017546.exe
    C:\WINDOWS\system32\drivers\down\1029765.exe
    C:\WINDOWS\system32\drivers\down\1045031.exe
    C:\WINDOWS\system32\drivers\down\1055125.exe
    C:\WINDOWS\system32\drivers\down\1087593.exe
    C:\WINDOWS\system32\drivers\down\1099328.exe
    C:\WINDOWS\system32\drivers\down\1108046.exe
    C:\WINDOWS\system32\drivers\down\1112843.exe
    C:\WINDOWS\system32\drivers\down\1126718.exe
    C:\WINDOWS\system32\drivers\down\1155859.exe
    C:\WINDOWS\system32\drivers\down\1197500.exe
    C:\WINDOWS\system32\drivers\down\1209015.exe
    C:\WINDOWS\system32\drivers\down\1218750.exe
    C:\WINDOWS\system32\drivers\down\3599765.exe
    C:\WINDOWS\system32\drivers\down\3613593.exe
    C:\WINDOWS\system32\drivers\down\3619125.exe
    C:\WINDOWS\system32\drivers\down\3639640.exe
    C:\WINDOWS\system32\drivers\down\3695453.exe
    C:\WINDOWS\system32\drivers\down\3704781.exe
    C:\WINDOWS\system32\drivers\down\3724718.exe
    C:\WINDOWS\system32\drivers\down\3735953.exe
    C:\WINDOWS\system32\drivers\down\3746671.exe
    C:\WINDOWS\system32\drivers\down\3762640.exe
    C:\WINDOWS\system32\drivers\down\3787796.exe
    C:\WINDOWS\system32\drivers\down\3799453.exe
    C:\WINDOWS\system32\drivers\down\3806312.exe
    C:\WINDOWS\system32\drivers\down\3809468.exe
    C:\WINDOWS\system32\drivers\down\3822578.exe
    C:\WINDOWS\system32\drivers\down\3851359.exe
    C:\WINDOWS\system32\drivers\down\3890843.exe
    C:\WINDOWS\system32\drivers\down\3903140.exe
    C:\WINDOWS\system32\drivers\down\3909390.exe
    C:\WINDOWS\system32\drivers\down\853125.exe
    C:\WINDOWS\system32\drivers\down\858343.exe
    C:\WINDOWS\system32\drivers\down\905171.exe
    C:\WINDOWS\system32\drivers\down\913890.exe
    C:\WINDOWS\system32\drivers\down\923656.exe
    C:\WINDOWS\system32\drivers\down\937531.exe
    C:\WINDOWS\system32\drivers\down\986593.exe
    C:\WINDOWS\system32\drivers\down\996875.exe
    C:\WINDOWS\system32\drivers\hldrrr.exe
    C:\WINDOWS\system32\drivers\srosa.sys
    C:\WINDOWS\system32\mdelk.exe
    C:\WINDOWS\system32\wintems.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_SROSA


    ((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-31 )))))))))))))))))))))))))))))))
    .

    2008-03-28 21:45 . 2008-03-28 21:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum
    2008-03-28 13:02 . 2008-03-28 13:02 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\softvibe
    2008-03-21 16:50 . 2008-03-21 16:50 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\PlayFirst
    2008-03-19 09:09 . 2008-03-19 09:17 <DIR> d-------- C:\Program Files\VitalDesktop
    2008-03-18 14:34 . 2006-03-01 05:21 1,263,616 --a------ C:\WINDOWS\system32\Aurora Vista.scr
    2008-03-18 14:34 . 2006-03-01 05:21 117,248 --a------ C:\WINDOWS\system32\Ribbons Vista.scr
    2008-03-18 14:34 . 2006-03-03 14:42 117,248 --a------ C:\WINDOWS\system32\Mystify Vista.scr
    2008-03-18 14:23 . 2006-03-01 04:53 773,120 --a------ C:\WINDOWS\system32\Bubbles Vista.scr
    2008-03-17 21:01 . 2008-03-17 21:01 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\cerasus.media
    2008-03-15 23:36 . 2008-03-15 23:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kayo Games
    2008-03-13 17:30 . 2008-03-13 17:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Go Go Gourmet
    2008-03-13 17:28 . 2008-03-13 17:28 356,352 --a------ C:\WINDOWS\eSellerateEngine.dll
    2008-03-11 08:38 . 2008-03-13 17:28 1,720,111 --a------ C:\WINDOWS\hctpro43.exe
    2008-02-28 18:17 . 2008-02-28 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MonteCristo
    2008-02-25 12:43 . 2006-12-04 10:03 77,824 --------- C:\WINDOWS\system32\KmRemove.exe
    2008-02-25 12:43 . 2006-06-14 18:06 7,952 --a------ C:\WINDOWS\system32\drivers\Maestro1.sys
    2008-02-23 12:17 . 2008-02-23 12:17 <DIR> d-------- C:\Program Files\Realtek AC97
    2008-02-23 10:45 . 2008-02-25 12:43 <DIR> d-------- C:\Program Files\KMaestro
    2008-02-23 00:41 . 2008-02-23 12:17 <DIR> d-------- C:\Program Files\Realtek AC97(2)
    2008-02-18 18:11 . 2008-02-18 18:11 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
    2008-02-18 15:40 . 2008-02-18 15:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
    2008-02-17 10:52 . 2008-02-17 10:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\JollyBear
    2008-02-17 00:35 . 2008-02-17 00:35 <DIR> d-------- C:\Program Files\MSXML 6.0
    2008-02-16 09:58 . 2008-02-25 12:06 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
    2008-02-16 09:57 . 2008-02-16 09:57 <DIR> d-------- C:\Program Files\Reference Assemblies
    2008-02-16 09:57 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
    2008-02-12 16:40 . 2008-02-12 16:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SnapStream
    2008-02-12 16:24 . 2008-02-12 16:56 <DIR> d-------- C:\WINDOWS\system32\URTTemp
    2008-02-12 12:41 . 2008-03-06 20:53 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\VideoReDo-TVSuite
    2008-02-12 10:39 . 2008-03-09 10:59 69 --a------ C:\WINDOWS\NeroDigital.ini
    2008-02-12 10:26 . 2008-02-19 11:29 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\Ahead
    2008-02-12 10:25 . 2008-02-12 10:25 <DIR> d-------- C:\Program Files\Nero
    2008-02-12 10:25 . 2008-02-12 10:26 <DIR> d-------- C:\Program Files\Common Files\Ahead
    2008-02-12 10:25 . 2008-02-12 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-02-11 11:13 . 2008-03-28 12:40 <DIR> d-------- C:\my flashes
    2008-02-11 11:02 . 2005-03-29 08:34 246,784 --a------ C:\WINDOWS\system32\sqlite3.dll
    2008-02-09 09:29 . 2008-02-09 09:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nokia
    2008-02-09 09:29 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
    2008-02-09 09:29 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
    2008-02-09 09:29 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
    2008-02-09 09:29 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
    2008-02-09 09:29 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
    2008-02-09 09:27 . 2008-02-09 09:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
    2008-02-09 09:14 . 2006-08-30 01:56 32,377 --a------ C:\WINDOWS\system32\drivers\prodigy.sys
    2008-02-07 16:00 . 2008-02-07 16:00 <DIR> d--hs---- C:\Documents and Settings\Anthony\Phone Browser
    2008-02-07 16:00 . 2008-02-07 22:05 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\Nokia Multimedia Player
    2008-02-07 15:53 . 2008-02-07 15:53 <DIR> d-------- C:\Program Files\DIFX
    2008-02-07 15:53 . 2008-02-07 15:53 <DIR> d-------- C:\Program Files\Common Files\PCSuite
    2008-02-07 15:53 . 2008-02-09 09:28 <DIR> d-------- C:\Program Files\Common Files\Nokia
    2008-02-07 15:53 . 2008-02-07 22:06 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\Nokia
    2008-02-07 15:53 . 2008-02-07 15:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
    2008-02-07 15:52 . 2008-02-07 15:52 <DIR> d-------- C:\Program Files\PC Connectivity Solution
    2008-02-07 15:52 . 2008-02-18 15:39 <DIR> d-------- C:\Program Files\Nokia
    2008-02-07 15:52 . 2008-02-07 18:12 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\PC Suite
    2008-02-07 15:52 . 2008-02-07 15:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
    2008-02-07 15:52 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
    2008-02-06 17:59 . 2008-02-06 17:59 <DIR> d-------- C:\Program Files\AC3Filter
    2008-02-06 17:59 . 2007-08-18 18:54 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm
    2008-02-02 15:25 . 2008-02-02 15:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-31 08:51 --------- d-----w C:\Program Files\eMule
    2008-03-31 07:32 --------- d-----w C:\Program Files\CursorXP
    2008-03-31 07:17 --------- d-----w C:\Documents and Settings\Anthony\Application Data\AVG7
    2008-03-31 05:13 --------- d-----w C:\Documents and Settings\Anthony\Application Data\LumaPix
    2008-03-30 22:50 --------- d-----w C:\Documents and Settings\Anthony\Application Data\MailWasherPro
    2008-03-28 10:39 --------- d-----w C:\Program Files\Registry Clean Expert
    2008-03-28 10:33 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-03-26 04:20 --------- d-----w C:\Program Files\Chattage
    2008-03-04 00:04 --------- d-----w C:\Program Files\Common Files\vbAccelerator
    2008-02-23 01:17 --------- d-----w C:\Program Files\AvRack
    2008-02-18 04:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-18 04:39 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-02-15 23:03 --------- d-----w C:\Program Files\MSBuild
    2008-02-14 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-02-14 23:03 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-02-12 10:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-02-06 05:28 --------- d-----w C:\Program Files\DivX
    2008-01-30 07:17 --------- d-----w C:\Program Files\Microsoft Xbox 360 Accessories
    2008-01-30 06:53 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
    2008-01-30 06:53 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
    2007-12-16 13:03 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
    2007-12-16 13:03 249,856 ------w C:\WINDOWS\Setup1.exe
    2007-12-16 03:51 47,360 ----a-w C:\Documents and Settings\Anthony\Application Data\pcouffin.sys
    2007-12-16 01:24 161,304 ----a-w C:\WINDOWS\FotoFusion Uninstaller.exe
    2007-12-05 09:41 49,152 ----a-w C:\WINDOWS\afaunist.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
    "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:44 140288]
    "Center Agent"="C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe" [2007-07-12 18:00 1435648]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 16:14 147456]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
    "VD"="" []

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 22:32 208952]
    "PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2002-08-28 22:39 455168]
    "PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2002-08-28 22:39 455168]
    "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
    "SoundMan"="SOUNDMAN.EXE" [2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]
    "Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]
    "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-31 22:02 579072]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
    "nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
    "BtcMaestro"="C:\Program Files\KMaestro\KMaestro.exe" [2006-12-14 19:45 339968]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-31 21:57 219136]
    "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 03:18 437160]
    "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]

    C:\Documents and Settings\Anthony\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 04:45:42 101784]
    Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-12-14 15:27:15 3581680]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
    avgwlntf.dll 2007-12-12 12:01 9216 C:\WINDOWS\system32\avgwlntf.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
    C:\Program Files\AlienGUIse\fastload.dll 2001-12-20 23:34 24576 C:\Program Files\AlienGUIse\fastload.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=wbsys.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
    backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
    --a------ 2007-01-15 16:14 147456 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    --a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Auto Shutdown]
    --a------ 2007-09-15 11:45 1392728 C:\Program Files\PC Auto Shutdown\AutoShutdown.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    --a------ 2006-11-28 14:12 222720 D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]
    --a------ 2007-08-19 01:56 450808 C:\Program Files\Registry Clean Expert\RCHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
    --a------ 2007-09-26 18:05 734264 C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\NavDiag\\Navini Diagnostics.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
    "C:\\Program Files\\Ares\\Ares.exe"=
    "C:\\Program Files\\eMule\\emule.exe"=
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
    "3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
    "50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
    "50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

    R2 NMSSvc;Intel(R) NMS;C:\WINDOWS\System32\NMSSvc.exe [2002-05-03 12:36]
    R2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys [2002-07-01 13:07]
    R2 PCAutoShutdown_Service;PCAutoShutdown_Service;C:\Program Files\PC Auto Shutdown\ShutdownService.exe [2007-09-14 17:03]
    R3 AF15BDA;AF9015 BDA Filter;C:\WINDOWS\system32\DRIVERS\AF15BDA.sys [2007-11-20 18:18]
    R3 NMSCFG;NIC Management Service Configuration Driver;C:\WINDOWS\system32\drivers\NMSCFG.SYS [2002-05-03 12:36]
    R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2002-07-01 13:07]
    R3 pctvvbi;PCTVVBI;C:\WINDOWS\system32\DRIVERS\pctvvbi.sys [2002-04-02 15:05]
    R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver;C:\WINDOWS\system32\Drivers\WBMS.SYS [2002-03-01 14:20]
    S0 NVDual;NVDual;C:\WINDOWS\system32\DRIVERS\nvDual.sys []
    S1 srosa;Megadrv3;C:\WINDOWS\system32\drivers\srosa.sys []
    S3 WFsys;WinFox Control I/O Driver;C:\WINDOWS\system32\DRIVERS\wfsys.sys [2002-04-22 15:15]

    *Newly Created Service* - NMSCFG
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-03-30 22:51:32 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-31 22:13:57
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    d:\Program Files\CPUCooL\CooLSrv.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\AlienGUIse\wbload.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    .
    **************************************************************************
    .
    Completion time: 2008-03-31 22:20:14 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-03-31 11:20:11
    Pre-Run: 103,919,726,592 bytes free
    Post-Run: 103,494,483,968 bytes free
    .
    2008-03-28 09:29:03 --- E O F ---
  2. 2008-03-31, 13:51 #2
    sotong
    sotong is offline
    Junior Member
    Join Date
    Aug 2006
    Posts
    10

    Default

    Not enough space so I've attached HiJack This log here:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:26:41 PM, on 31/03/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    d:\Program Files\CPUCooL\CooLSrv.exe
    C:\WINDOWS\System32\NMSSvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\PC Auto Shutdown\ShutdownService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\AlienGUIse\wbload.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\KMaestro\KMaestro.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [BtcMaestro] "C:\Program Files\KMaestro\KMaestro.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKCU\..\Run: [Center Agent] C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
    O8 - Extra context menu item: &Save Flash In This Page by Flash Saver - D:\PROGRA~1\FLASHS~1\save.htm
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - D:\PROGRA~1\FLASHS~1\save.htm
    O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - D:\PROGRA~1\FLASHS~1\save.htm
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1197275244328
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BFE15AC3-CCA2-4A85-B69B-A9D3CAA87951}: NameServer = 220.233.0.4,220.233.0.3
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
    O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
    O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
    O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - d:\Program Files\CPUCooL\CooLSrv.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PCAutoShutdown_Service - GoldSolution Software, Inc. - C:\Program Files\PC Auto Shutdown\ShutdownService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

    --
    End of file - 10529 bytes
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules